I imagine that's done via JIRA tcket/IT before onboarding.
So if they somehow can get past initial device deployment/user account logon, and get other resources IE; slack....well that speaks to how difficult/pointless it would be to get proper VPN/Jira access.
So if they somehow can get past initial device deployment/user account logon, and get other resources IE; slack....well that speaks to how difficult/pointless it would be to get proper VPN/Jira access.